glgachad[.]xyz

This domain, glgachad.xyz, is identified as a crypto drainer phishing site designed to compromise cryptocurrency wallet credentials. Analysis indicates no direct brand impersonation, but the infrastructure aligns with known wallet-draining kits observed in prior campaigns. The site likely employs fake login portals or malicious smart contract interactions to siphon funds from victims' wallets upon connection. Infrastructure analysis reveals the following technical indicators: the domain was registered on March 28, 2026, through PDR Ltd. d/b/a PublicDomainRegistry.com and resolves to the IP address 188.114.97.3. Security vendor detections on VirusTotal stand at 5 out of 95, while it appears on three independent security blocklists. AlienVault OTX records the domain in one threat intelligence pulse, and Gridinsoft assigns a trust score of 0/100. The domain is not currently listed by Google Safe Browsing but has been proactively blocked by multiple wallet security providers. As of the latest verification, glgachad.xyz has been taken offline, likely due to enforcement actions by hosting providers or registrars. However, residual risk persists as threat actors may re-deploy the domain or migrate infrastructure to new addresses. Users who interacted with the site should immediately revoke wallet permissions, transfer remaining assets to a secure wallet, and monitor for unauthorized transactions. Security teams are advised to update blocklists and monitor for related domains registered under the same registrar or resolving to the identified IP.